Always Encrypted - get it working

[lokmannicholas]

• What is the correct connection string for Always Encrypt?
• How to integrate with Key Vault?
• Any example to Insert or Update the data?

I have an issue with updating an encrypted field.
For example:
My table members has an column dob which is encrypted

I can exec it in Azure studio, but cannot implement in code.

DECLARE @dob varchar(10) = '2022-06-01';
Update members SET dob  = @dob where id = '123';

I always get The encryption scheme for the columns/variables is (encryption_type = 'PLAINTEXT') and the expression near line '2' expects it to be DETERMINISTIC, or PLAINTEXT.

Thanks

[wcraigjones]

Did you have any success getting this to work @lokmannicholas ?

[shueybubbles]

Does this driver even claim support for AE? It looks like this PR never got in:
denisenkom#637

[nicholas-atg]

Did you have any success getting this to work @lokmannicholas ?

it doesn't work, i am finding someone to make it work together @@

[timothytavarez]

@shueybubbles Is it possible to raise some attention on this? Always Encrypted is in a bad place right now with language support outside of the C#/.NET/Java ecosystems. *Open source SQL drivers have MSSQL as an afterthought, and ODBC C++ wrappers have very mixed support (such as in the case of this situation).

I'm trying really hard to use Azure SQL for its Always Encrypted with Secure enclaves capabilities in a solution I'm building, but it is getting harder and harder to justify.

[shueybubbles]

We are building a multi-phase plan for AE. Each phase corresponds to a complete set of functionality that can be released.
Phase 1 -
a. Define the connection string (including enclave settings)
b. Define a key provider interface, including how to pass along authentication parameters
c. Implement the AKV key provider
d. Configurable CEK cache
e. E2E testing of decrypting using AKV. This part will likely be done internally since it requires a real Azure sub.
Phase 2 -
a. Support for encryption of parameters in parameterized queries
b. Add a local certificate key provider
c. Enclaves
Phase 3 -
a. Performance tuning